CVE-2021-24540

The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.

Affected products

Wonder Video Embed

Wonderplugin Wonder Video Embed

< 1.8

Fix

Available

CVSS 3.1

5.4 MEDIUM

EPSS

0.6% (47th percentile)

Weakness

CWE-79

NVD status

Modified

Published

2021-08-16